Object Attributes

A list of audit hosts/servers. Audit records are sent to the first available host. If a host is unreachable or a timeout occurs while sending data, the next host in the list is tried. If connection to all hosts fails, the list is tried again from the beginning.

The port part of a p_hosts entry is the port on host that is contacted to initiate an audit server connection. If not specified, the port number is that assigned to the solaris-audit service. See getservbyname(3XNET).

The mech part of a p_host entry is the GSS-API mechanism name (mech(4)). If not specified, the local host's default
mechanism is used. The recommended mechanism is kerberos_v5.

p_retries

The number of retries for connecting to and sending data to a server.

The default value is 3.

p_timeout

The number of seconds in which a connection/sending data timeouts.

The default value is 5 seconds.

qsize

The maximum number of outstanding audit records to keep.

The default is the value of the kernel queue control high water mark. See auditconfig(1M).

GSS SESSION

The audit_remote plugin is a TCP client that authenticates configured audit servers using the GSS-API (libgss(3LIB)). Binary
Solaris Audit records are sent with integrity and confidentiality protection as per-message tokens generated by gss_wrap(3GSS).

If no port is specified, the service name solaris-audit is looked up to obtain a TCP port number. If no mechanism is specified, the GSS_C_NO_OID is used as a mech_type parameter of gss_init_sec_context(3GSS), and causes the underlying GSS-API to use the local default mechanism.

Once the security context is established, the client (audit_remote plugin) calls gss_wrap(3GSS) to achieve the confidentiality
of the transferred payload - the audit records. The server is expected to use gss_unwrap(3GSS) to unwrap the received data and gss_get_mic(3GSS) to obtain the MIC (Message Integrity Code) to be later sent back to the plugin as a message retrieval acknowledgment.

For example, if the kerberos_v5 mechanism is configured as GSS_API mechanism on the client and both sides agree on using this mechanism, the client side has to be eligible to non-interactively gain session keys for the audit/<host_fqdn>@<REALM> principal from the Kerberos KDC/TGS. At the same time the identity running the audit server application has to have the long term keys associated with the audit/<host_fqdn>@<REALM> principal stored in the keytab file (krb5.conf(4)) to be able to decrypt the session keys.

The audit_remote plugin initiates a connection to first server in the p_hosts list. If the connection fails or audit record sends are not responded to in p_timeout seconds, after p_retries attempts the plugin tries
to connect to the next server. If the connection to the last server fails, the plugin retries to connect to the first host in the list. audit_warn(1M) is
executed at every unsuccessful attempt to connect to the server or send timeout with the plugin option plugin audit_remote.so retry <count> <error>.<error> is connection <host:port> <the network error>. An EPROTO network error
indicates that the client plugin did not get a successful protocol version handshake.

PROTOCOL DESCRIPTION

All protocol messages are preceded by the 4 octets of the size of the data to follow. This size is in network byte order.

The protocol begins with version negotiation followed by a GSS-API security context token exchange. On error the connection is closed (and any output token optionally sent).

The version negotiation takes place in the clear with the plugin sending an octet array of the comma (,) separated list of versions supported. The current version number is the characters 01. The receiver is expected to respond with the version that
they accept (in the current case that is the characters 01). A mismatch is considered an error and the connection is closed.

The version octet array sent by the plugin and the version characters accepted by the receiver are concatenated together to make up the application data field of the channel bindings of the GSS security context establishment.

Subsequent tokens contain a 64 bit sequence number in network byte order and a single audit record (audit.log(4)); the client uses confidentiality
protection. wrap (64 bit sequence number || audit record)

The server acknowledges the receipt (and is then responsible for any data loss) with the received 64 bit sequence number and a MIC token of the unwrapped 64 bit sequence number and audit record. MIC verification on the client side acknowledges the audit record can be freed and not saved
for possible retransmission.

Examples

The following directives cause audit_remote.so to be loaded and specify the remote audit servers to where the audit records are sent. The kerberos_v5 security mechanism is defined to be used when communicating with the servers.